Monitor unlimited number of servers
Filter log events
Create email and web-based reports
Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content
Event ID: 1017 Source: Perflib
Source
Level
Description
Performance counter data collection from the "<service name>" service has been disabled due to one or more errors generated by the performance counter library for that service. The error(s) that forced this action have been written to the application event log. The error(s) should be corrected before the performance counters for this service are enabled again.
English
This information is only available to
subscribers. An example of English, please!
Concepts to understand
Comments
Some Microsoft articles describe this type of error as being specific to each performance counter (i.e. a bug in the corresponding libraries) and recommends contacting the software vendor. In support forums the general solution is to disable the counters recorded in the event description by looking them up in the registry and remove the relevant registry keys.
Service: "Tcpip" - I got this after manually rebuilding the performance library on as server.
The problem may occur because the extensible performance DLL is marked as "disabled". The object may be reenabled by setting the "Disable Performance Counters" registry value in the Performance subkey of the supported service for the extension.
Windows Event Log Analysis Splunk App
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Cisco ASA Log Analyzer Splunk App
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.